CVE-2026-12632

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The Precision Time Protocol (PTP) receive handler ptp msg post recv() in subsys/net/lib/ptp/msg.c fails to perform an upper-bound check on the 4-bit message type obtained via ptp msg type(). This allows the message type to index the msg size[] table beyond its defined size of 14 entries, leading to an out-of-bounds read of adjacent read-only data. The resulting value can be used as a length in msg tlv post recv(), potentially causing further out-of-bounds reads and in-place byte-swap writes on memory beyond the message slab. This issue is reachable via unauthenticated PTP frames using UDP multicast or raw Ethernet (0x88F7) through the ptp port event gen() function in subsys/net/lib/ptp/port.c, which calls ptp msg post recv(). The primary impact is a denial of service resulting in a system crash, although limited memory corruption is possible depending on build-specific memory layout.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.